att[.]unlocklearn[.]com

This domain, att.unlocklearn.com, is identified as a credential theft operation specifically targeting AT&T customers through a fraudulent agency onboarding program. The page title, 'AT&T | Agency Onboarding Program,' directly impersonates the telecommunications provider to deceive users into submitting login credentials or sensitive personal information. Analysis indicates this is not a generic phishing attempt but a targeted campaign exploiting trust in the AT&T brand to harvest authentication details for unauthorized account access or identity fraud.

Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on September 14, 2020, and currently resolves to the IP address 104.26.7.20, hosted on Cloudflare, Inc. (AS13335). The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing sites. Despite the use of reputable hosting and certificate providers, the domain's malicious intent is confirmed by its inclusion in threat intelligence feeds and its consistent detection by multiple security engines.

As of the latest assessment, att.unlocklearn.com has been taken offline, likely due to enforcement actions or automated takedown processes. However, the domain's infrastructure remains a potential risk, as threat actors may reactivate it or migrate to similar domains. Organizations and users are advised to block the domain and its associated IP (104.26.7.20) at the network level, monitor for related indicators of compromise, and implement multi-factor authentication (MFA) to mitigate credential theft risks. Security teams should also review logs for any prior interactions with this domain and educate users on recognizing brand impersonation tactics in phishing campaigns.